Skip to content

Bump the npm-minor-and-patch group with 6 updates - #183

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-and-patch-30a34d1b92
Closed

Bump the npm-minor-and-patch group with 6 updates#183
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-and-patch-30a34d1b92

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 6 updates:

Package From To
@valibot/to-json-schema 1.7.1 1.8.0
valibot 1.4.2 1.5.0
@types/node 26.5.0 26.5.1
fast-check 4.9.0 4.10.0
lint-staged 17.5.0 17.5.1
vite 8.2.2 8.3.0

Updates @valibot/to-json-schema from 1.7.1 to 1.8.0

Release notes

Sourced from @​valibot/to-json-schema's releases.

v1.8.0 (to-json-schema)

Many thanks to @​dylanpulver, @​dzhu-amplify, @​francisjohnjohnston-web, @​idleberg, @​jagregory, @​lazerg, @​LeSingh1, @​MathurAditya724, @​maximilliangrand, @​MFA-G, @​mrlubos, @​rajanpanth, @​sanjibani, @​spokodev, @​ysknsid25, and @​yslpn for contributing to this release.

  • Add support for ksuid action (pull request #1370)
  • Add passthrough of other metadata action properties to support custom annotations and standard keywords like format, which take precedence over generated properties (pull request #1591)
  • Fix overlapping values, notValue and notValues actions to preserve all restrictions, including value actions for OpenAPI 3.0 (pull request #1613)
  • Fix value actions to report conflicting constant restrictions by default (pull request #1613)
  • Fix empty and duplicate requirements of values and notValues actions to produce valid enum restrictions or an impossible schema (pull request #1613)
  • Fix overlapping numeric, length, and object entry bounds to preserve the stricter constraints, including combinations with nonEmpty and safeInteger actions (pull request #1611)
  • Fix minValue, maxValue, gtValue and ltValue actions to reject NaN and infinite requirements by default and skip them in warn and ignore error modes (pull request #1611)
  • Fix length, minLength, maxLength, entries, minEntries and maxEntries actions to require non-negative integers by default and skip invalid requirements in warn and ignore error modes (pull request #1611)
  • Fix examples property type of JsonSchema to always be an array (pull request #1607)
  • Fix JSON compatibility validation of literal schemas to reject NaN and infinite numbers by default (pull request #1573)
  • Fix JSON compatibility validation of enum and picklist schemas to reject NaN and infinite numbers by default (pull request #1612)
  • Fix literal, enum and picklist schemas to skip unsupported values in warn and ignore error modes (pull request #1612)
  • Fix minValue, maxValue, gtValue and ltValue actions to skip numeric constraints on unsupported types in warn and ignore error modes (pull request #1595)
  • Fix generation of reference IDs for lazy schemas to produce consistent output and avoid collisions with existing definitions (pull request #1604)
  • Change ConversionContext.referenceMap type from Map to its ReferenceMap subclass (pull request #1604)
  • Change Valibot peer dependency to v1.5.0
Commits

Updates valibot from 1.4.2 to 1.5.0

Release notes

Sourced from valibot's releases.

v1.5.0

Many thanks to @​tats-u, @​idleberg, @​yslpn, @​francisjohnjohnston-web, @​MaxFreedomPollard, @​mahirhir, @​ItzXynx, @​LeSingh1, @​maxtaran2010, @​ysknsid25, @​cyyynthia, @​spokodev and @​sanjibani for contributing to this release.

  • Add codePoints, maxCodePoints, minCodePoints and notCodePoints validation actions to validate the number of Unicode code points (pull request #888)
  • Add ksuid validation action to validate KSUIDs (pull request #1370)
  • Change Standard Schema properties to use eager initialization for faster schema construction and replace internal _getStandardProps utility with _standardSchema (pull request #1534)
  • Change url action to use URL.canParse when available to avoid constructing URL objects (pull request #1608)
  • Fix stringifyJson action to preserve the dataset value when JSON.stringify returns undefined (pull request #1476)
  • Fix literal schema and value, values, notValue and notValues actions to treat NaN as equal to itself (pull request #1573)
  • Fix intersect schema to merge matching NaN values and invalid dates (pull request #1573)
  • Fix cache and cacheAsync methods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)
  • Fix strictObject, looseObject, objectWithRest and their async variants to correctly handle unknown input keys that collide with Object.prototype members (pull request #1523)
  • Fix intersect and intersectAsync schemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)
  • Fix ulid action to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)
  • Fix email action to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)

v1.5.0 (to-json-schema)

  • Add support for JSON Schema draft-2020-12 and OpenAPI 3.0 Schema Object format
  • Add propertyNames support to record schemas for key validation constraints
  • Add support for toBigint, toBoolean, toDate, toNumber and toString actions for typeMode: 'input'
  • Add new toStandardJsonSchema function to convert Valibot schemas to Standard JSON Schema format
  • Change return type from JSONSchema7 to a custom JsonSchema type
Commits
  • 5016198 chore: prepare Valibot v1.5.0 release (#1627)
  • 1ffb038 fix(intersect): skip inherited prototype props in _merge (#1621)
  • 1c4983f fix(ulid): restrict first character to 0-7 per ULID spec (#1498)
  • 5e449cd perf(url): use URL.canParse for validation (#1608)
  • 4acda1b Make sure that email validators don't match unintentional non-ASCII local par...
  • 95943ab fix: handle object keys that collide with Object.prototype in object schemas ...
  • d65438c fix(cache): clone cached issues to stop issue paths from accumulating (#1620)
  • 3ed804a dependabot: bump the github-actions group across 1 directory with 2 updates (...
  • 0681f43 fix: use SameValueZero equality for special numeric values (#1573)
  • 98ef8b4 Improve perf by changing ~standard implementation (#1534)
  • Additional commits viewable in compare view

Updates @types/node from 26.5.0 to 26.5.1

Commits

Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit
Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit
Commits
  • 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
  • a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
  • 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
  • 5382221 🗑️ Deprecate v5 removals (#7261)
  • 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
  • a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
  • 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
  • 917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
  • 32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
  • 485f337 👥 Add jkomyno as code contributor (#7246)
  • Additional commits viewable in compare view

Updates lint-staged from 17.5.0 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

  • #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

  • #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

Commits
  • f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
  • 3b54961 chore(changeset): release
  • 09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
  • bfcca94 fix: change defineConfig signature from const to a function
  • See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-minor-and-patch group with 6 updates
1d5a116 
Bumps the npm-minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@valibot/to-json-schema](https://github.com/open-circle/valibot) | `1.7.1` | `1.8.0` |
| [valibot](https://github.com/open-circle/valibot) | `1.4.2` | `1.5.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.5.1` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.0` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.5.0` | `17.5.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |


Updates `@valibot/to-json-schema` from 1.7.1 to 1.8.0
- [Release notes](https://github.com/open-circle/valibot/releases)
- [Commits](https://github.com/open-circle/valibot/commits)

Updates `valibot` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/open-circle/valibot/releases)
- [Commits](open-circle/valibot@v1.4.2...v1.5.0)

Updates `@types/node` from 26.5.0 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `fast-check` from 4.9.0 to 4.10.0
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.0/packages/fast-check)

Updates `lint-staged` from 17.5.0 to 17.5.1
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.5.0...v17.5.1)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@valibot/to-json-schema"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: valibot
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: fast-check
  dependency-version: 4.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: lint-staged
  dependency-version: 17.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Sep 16, 2026
@dependabot
dependabot Bot requested a review from andrewkoltsov as a code owner September 16, 2026 07:05
@dependabot dependabot Bot added the dependencies Dependency updates label Sep 16, 2026
@socket-security

socket-security Bot commented Sep 16, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​node@​26.5.0 ⏵ 26.5.110010081 +196 +1100
Updatedvite@​8.2.2 ⏵ 8.3.099 +110082 +197100
Updated@​valibot/​to-json-schema@​1.7.1 ⏵ 1.8.0100 +110010089 +6100
Updatedvalibot@​1.4.2 ⏵ 1.5.01001009989100
Updatedfast-check@​4.9.0 ⏵ 4.10.0100 +1100100 +190 -1100
Updatedlint-staged@​17.5.0 ⏵ 17.5.1100 +110010097 +2100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 19, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-30a34d1b92 branch September 19, 2026 07:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkoltsov andrewkoltsov Awaiting requested review from andrewkoltsov andrewkoltsov is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants